# Lincoln Electric System Procureware #125-26

LES annual cybersecurity, web, wireless, social-engineering, and physical penetration testing

**Posted:** October 08, 2026
**Respond By:** October 27, 2026
**Identifier:** 125-26
**NAICS:** 541512

Lincoln Electric System (LES) is seeking an annual, end-to-end cybersecurity and physical security penetration-testing engagement.
- **Government buyer:** Lincoln Electric System (LES), a municipal corporation doing business as the City of Lincoln, Nebraska; LES Procurement Department.
- **Scope of work:** Test LES’s internal and external networks, web applications, wireless networks, employee exposure to open-source intelligence gathering, social-engineering susceptibility, and physical security at a minimum of four facilities.
  - Wireless: test up to 10 SSIDs at one facility.
  - Web applications: two independent tests—an approximately 150-page customer payment portal and an approximately 200-page public website.
  - External network: one opaque test covering 21 live IP addresses, two /21 subnets, and one public domain.
  - Internal network: one test covering approximately 600 live IP addresses across multiple subnets in one Active Directory/Entra environment.
  - Social engineering: assess four LES-provided targets from two divisions; phishing, smishing, and vishing are requested, with AI voice as an option.
  - Physical security: external and internal testing at at least four facilities; potential techniques include badge cloning, USB drops, tailgating, unauthorized device connections, simulated theft, and drone-surveillance susceptibility testing.
- **Deliverables and notable requirements:** Provide encrypted technical findings, attack-path documentation, prioritized remediation recommendations, a debrief, an inventory of collected data and evidence of its deletion, and validation retesting approximately 60 days after the final report. The vendor must document rules of engagement, scope boundaries, escalation and communications procedures, and stop-work criteria. LES requires an experienced enterprise penetration-testing provider that is independent of LES; the provider cannot be LES’s current Managed Security Service Provider or have performed penetration testing for LES during the preceding 12 months. Contractors must also meet LES confidentiality, facility, personnel, and network security requirements and applicable Nebraska LB1300 certification requirements.
- **OEMs and vendors:** No product OEMs are specified. Sterling is named in the prospective-bidders section; no award or selection is indicated.
- **Period:** The engagement is described as annual, with testing conducted in phased workstreams and validation retesting following delivery of the final report. No specific start or end date is stated here.

### Description

Lincoln Electric System is seeking proposals to select a provider for annual external, internal, and physical penetration testing of its IT environment, web applications, systems, and physical infrastructure. The scope includes OSINT, wireless and web application testing, external and internal network testing, social engineering, and physical penetration testing at a minimum of four LES facilities. The selected vendor must not currently serve as LES's Managed Security Service Provider or have performed penetration testing services for LES during the prior 12 months. Proposals must be submitted through the LES Procurement Portal by October 27, 2026, at 2:00 PM Central Time.

[View original listing](https://les.procureware.com/Bids/40b4ec47-8c04-4124-8d2f-56ef626e0692)